DanSec

Cybersecurity Brief

Tuesday 8 September 2026

In this brief Mathspace, Trezor, ShipMonk, Adobe, Meta, Grindr, +11 more
Vendors
Mathspace, Trezor, ShipMonk, Adobe, Meta, Grindr, FreeIPA, MikroTik, LG, N-able, CrowdStrike, Microsoft, Metabase, Magento, Nvidia, Avast
Threat actors
BengalSEO

Major Incidents or Breaches

  • Mathspace, an online maths learning platform, disclosed a data breach affecting over 1 million students, staff, and parents following a compromise of its Metabase internal reporting system. Attackers stole sensitive personal information[13][20].
  • Trezor, a cryptocurrency hardware wallet manufacturer, confirmed that the impact of an August data breach at its shipping and logistics provider ShipMonk now extends to 81,000 customers, with an additional 67,000 US customers affected[14].
  • An exposed Advance Passenger Information System (APIS) database linked to Vietnam resulted in the leak of 220 million passenger and crew records, including names, passport numbers, birth dates, nationalities, and flight details[10].
  • Grindr agreed to pay £26 million to settle UK claims that it shared users’ personal information, including HIV status, with third parties without proper consent[4].

Newly Discovered Vulnerabilities

  • A critical vulnerability chain in FreeIPA allows unauthenticated clients to create a Kerberos identity of their choosing and gain administrator privileges in the directory[1].
  • Adobe released patches for a maximum-severity zero-day vulnerability in Adobe Commerce and Magento Open Source, which has been actively exploited to deploy a Rust-based backdoor and PHP web shell. The flaw, dubbed “StyleSmuggler,” affects all versions and has been used to deploy Linux backdoors[2][11].
  • MikroTik patched critical RouterOS vulnerabilities that can be chained to bypass authentication, overwrite configuration files, and take over devices. Attackers have been observed exploiting these flaws to gain control of routers with SSH exposed to the internet[19][24].
  • LG smart TVs contain security flaws that could allow attackers to listen in on conversations, even when the TV is in standby mode. The devices also scan home networks and track viewing habits[26].
  • N-able addressed a critical zero-day vulnerability in its N-central platform and advised administrators to check for unauthorized user accounts[21].
  • Proof-of-concept exploits for zero-day vulnerabilities in CrowdStrike, Nvidia, and Avast products have been released, enabling privilege escalation and SYSTEM-level shell access[22].

Notable Threat Actor Activity

  • A phishing-as-a-service framework named BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal over 5,000 Microsoft 365 credentials[12].
  • Threat actors are increasingly using fake IT help desk calls to target executives and compromise Microsoft 365 and other SaaS accounts, leading to data theft and extortion[6].
  • The BengalSEO campaign is conducting large-scale SEO poisoning of Bing search results to distribute the MayaBot malware and facilitate tech support scams[3].
  • Hackers are developing AI multi-agent frameworks to automate credential theft at scale, moving beyond AI coding assistants to full attack automation[8].
  • Researchers disclosed a Chromium-based post-exploitation toolkit called PEEP, which poses as a bookmarks extension for Chrome and Edge. It requires prior admin access and enables host command execution post-compromise[5].
  • Attackers are using QR codes constructed from text in email phishing campaigns to bypass image-blocking security controls[7].
  • Loyalty points fraud is being used to fund illicit activities, with attackers increasingly targeting reward programs[25].

Regulatory or Policy Developments Affecting the Security Industry

  • UK lawmakers are planning to investigate Meta after it failed to detect hundreds of AI-generated ads containing child sexual abuse material, some of which included images of real children[17].

Sources

  1. Mathspace discloses data breach affecting over 1 million people - bleepingcomputer.com
  2. Mathspace Data Breach Exposes Over 1 Million People - securityweek.com
  3. Trezor data breach impact now reaches 81,000 customers - bleepingcomputer.com
  4. 220 million traveler records exposed in Vietnam-linked APIS leak - bleepingcomputer.com
  5. Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing - thehackernews.com
  6. FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials - thehackernews.com
  7. Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell - thehackernews.com
  8. Magento StyleSmuggler zero-day exploited to deploy Linux backdoor - bleepingcomputer.com
  9. MikroTik Patches Critical Flaws Chained to Hack Routers - securityweek.com
  10. MikroTik router flaws allow takeover without a password - malwarebytes.com
  11. LG TV flaws could let attackers listen in, even in standby mode - malwarebytes.com
  12. N-able Patches Critical Zero-Day in N-central - securityweek.com
  13. Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits - securityweek.com
  14. BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations - bleepingcomputer.com
  15. Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks - thehackernews.com
  16. BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams - thehackernews.com
  17. Hackers build AI frameworks for widescale credential theft - bleepingcomputer.com
  18. PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution - thehackernews.com
  19. ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More - thehackernews.com
  20. Loyalty points fraud is funding hacker holidays (Lock and Code S07E18) - malwarebytes.com
  21. Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids - wired.com